JP2017503289A - Terminal verification method, apparatus, program, and recording medium - Google Patents

Abstract

The present invention relates to a terminal verification method, apparatus, program, and recording medium, and belongs to the technical field of computers. The method establishes a secure channel with a server by a secure element at a terminal, and an initial terminal hardware parameter at the secure element via the secure channel using the secure element based on the terminal hardware parameter Transmitting the identification information to the server that feeds back the information, and determining a verification result for the authenticity of the terminal based on the identification information fed back from the server. The apparatus includes a channel establishment module, a parameter transmission module, and a result determination module. The present invention solves the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance deteriorates, and achieves the effect of improving the accuracy of verifying the authenticity of the terminal. [Selection] Figure 1

Description

  This application claims priority based on a Chinese patent application with an application number of CN20141602394.8 and an application date of October 31, 2014, the entire contents of which are incorporated herein by reference.

  The present invention relates to the technical field of computers, and more particularly to a terminal verification method and apparatus.

  As the speed at which a user replaces a terminal increases, some manufacturers may remove parts from the terminals discarded by the user and assemble the removed parts into one terminal for sale. Since the performance of the terminal obtained by assembling is not stable, the user needs to verify the purchased terminal and identify the authenticity of the terminal.

  If the verification application program is installed in the terminal, the terminal executes the verification application program and uses the verification application program from the CPU (Central Processing Unit) of the terminal to enter the model number, serial number, and IMEI (International Mobile). Terminal hardware parameters, including equipment identity, international mobile device identification number), internal memory, CPU parameters, camera parameters, etc., and compare terminal hardware parameters with the standard hardware parameters of the official version terminal. The score of the wear parameter can be calculated, and the authenticity of the terminal can be determined based on the score.

  In the process of realizing the present invention, the inventor, in the related art, at least when the terminal is used for a long time and the performance deteriorates, the rating of the terminal hardware parameter decreases, and the verification application program executes the authenticity of the terminal. It was discovered that there was a flaw that could not be identified.

  In order to solve the problem that the authenticity of the verification application program terminal cannot be identified because the terminal performance deteriorates, the present invention provides a terminal verification method and apparatus.

According to a first form of embodiment of the invention,
Establishing a secure channel with the server by a secure element at the terminal;
Transmitting an initial terminal hardware parameter in the secure element via the secure channel using the secure element to the server that feeds back identification information based on the terminal hardware parameter;
Confirming a verification result for authenticity of the terminal based on the identification information fed back from the server;
A terminal verification method is provided.

  Preferably, the terminal hardware parameter is written to the secure element before starting the terminal for the first time, and the terminal hardware parameter is in an edit prohibited state.

Preferably, the step of determining a verification result for authenticity of the terminal based on the identification information fed back from the server includes:
If the identification information is the terminal hardware parameter, comparing the terminal hardware parameter with a reference hardware parameter, and determining a verification result for the authenticity of the terminal based on the comparison result;
If the identification information is a comparison result generated after the server compares the terminal hardware parameter with a reference hardware parameter, the verification result for the authenticity of the terminal is determined based on the comparison result; Including.

Preferably, establishing a secure channel with a server by a secure element in the terminal comprises:
Sending a secure channel establishment request to the server by the secure element;
Receiving a selection command sent by the secure element based on the secure channel establishment request instructing the server to communicate with the secure element, and responding to the selection command;
Performing mutual verification with the server by the secure element;
Establishing the secure channel with the secure element after passing each other's verification.

Preferably, performing the mutual verification with the server by the secure element comprises:
Receiving, by the secure element, first verification information including an initialization update command and a first key value transmitted from the server;
After passing the verification of the first key value by the secure element, the server generates a second verification information including a card ciphertext and a second key value generated based on the initialization update command, and Sending to
Receiving an external authentication command having a host ciphertext generated and transmitted after passing through verification of the card ciphertext and the second key value by the server, transmitted from the server by the secure element;
After passing the verification of the host ciphertext by the secure element, and confirming that the verification with the server has passed each other.

According to the second aspect of the embodiment of the present invention,
A channel establishment module configured to establish a secure channel with the server by a secure element at the terminal;
The secure element is configured to transmit an initial terminal hardware parameter in the secure element to the server that feeds back identification information based on the terminal hardware parameter, using the secure channel established by the channel establishment module. A parameter transmission module
A result determination module configured to determine a verification result for authenticity of the terminal based on the identification information fed back from the server;
A terminal verification apparatus including

  Preferably, the terminal hardware parameter is written to the secure element before starting the terminal for the first time, and the terminal hardware parameter is in an edit prohibited state.

Preferably, the result determination module is
When the identification information is the terminal hardware parameter, the terminal hardware parameter is compared with a reference hardware parameter, and a verification result for the authenticity of the terminal is determined based on the comparison result. A confirmation submodule of
When the identification information is a comparison result generated after the server compares the terminal hardware parameter with a reference hardware parameter, the identification information is configured to determine a verification result for the authenticity of the terminal based on the comparison result. A second deterministic submodule.

Preferably, the channel establishment module is
A request sending sub-module configured to send a secure channel establishment request to the server by the secure element;
The selection is received by the secure element based on the secure channel establishment request transmitted from the request transmission submodule by the server and instructing the server to communicate with the secure element. A command response sub-module configured to respond to the command;
An information verification sub-module configured to perform mutual verification with the server by the secure element;
A channel establishment sub-module configured to establish the secure channel by the secure element after the information verification sub-module has determined that it has passed each other's verification.

Preferably, the information verification submodule includes:
An information receiving submodule configured to receive first verification information including an initialization update command and a first key value transmitted from the server by the secure element;
A second key value including a card ciphertext and a second key value generated based on the initialization update command after passing through the verification of the first key value received by the information receiving submodule by the secure element; An information transmission sub-module configured to generate and send verification information to the server;
External authentication having the host ciphertext generated and transmitted after passing the verification of the second key value and the card ciphertext transmitted from the information transmission submodule by the server, transmitted from the server by the secure element An instruction receiving submodule configured to receive instructions;
A verification confirmation submodule configured to determine that it has passed verification of each other with the server after passing verification of the host ciphertext received in the command reception submodule by the secure element; including.

According to the third aspect of the embodiment of the present invention,
A processor;
A memory for storing instructions executable by the processor,
The processor is
Establish a secure channel with the server using the secure element at the terminal,
Transmitting the initial terminal hardware parameters in the secure element via the secure channel using the secure element to the server that feeds back identification information based on the terminal hardware parameters;
Provided is a terminal verification device configured to determine a verification result for authenticity of the terminal based on the identification information fed back from the server.

  The technical means provided by the embodiments of the present invention can include the following beneficial effects.

  A secure channel with the server is established by the secure element at the terminal, and the initial terminal hardware parameter in the secure element is transmitted to the server that feeds back identification information based on the terminal hardware parameter via the secure channel using the secure element. The verification result for the authenticity of the terminal is determined based on the identification information fed back from the server, and the terminal hardware parameters are parameters that are initially written in the secure element and do not change as the terminal performance decreases. This guarantees the accuracy of the terminal hardware parameters, solves the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance deteriorates, and improves the accuracy of verifying the authenticity of the terminal To. In addition, since it is not necessary to calculate the terminal hardware parameter score, and the hardware parameter can be directly read to identify the authenticity of the terminal, the operation for identifying the authenticity of the terminal is simplified, Increase verification efficiency.

  It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the invention.

The drawings are hereby incorporated into the specification and are a part of the specification, illustrating examples consistent with the present invention and illustrating the principles of the invention together with the specification.
3 is a flowchart of a terminal verification method shown in an exemplary embodiment. 6 is a flowchart of a terminal verification method shown in another exemplary embodiment. FIG. 2 is a block diagram of a terminal verification apparatus shown in one exemplary embodiment. FIG. 2 is a block diagram of a terminal verification apparatus shown in one exemplary embodiment. FIG. 2 is a block diagram of a terminal verification apparatus shown in one exemplary embodiment.

  Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the drawings. When the following description relates to the drawings, the same reference numerals in different drawings denote the same or common elements unless otherwise indicated. All embodiments consistent with the present invention are not limited to the embodiments described in the following illustrative examples. Conversely, the embodiments described in the following illustrative examples are merely illustrative of apparatus and methods consistent with certain aspects of the present invention that are described in detail in the claims.

  FIG. 1 is a flowchart of a terminal verification method shown in one exemplary embodiment. The terminal verification method is applied to a terminal. As shown in FIG. 1, the terminal verification method includes the following steps.

  In step 101, a secure channel with the server is established by a secure element in the terminal.

  The secure element (Secure Element) is an element installed in the terminal. Since the terminal is not authorized to read data in the secure element, the terminal can establish a secure channel with the secure element by the server, and can acquire data in the secure element by the server. The secure channel is a channel that is established between the secure element and the server and performs data communication between the secure element and the server.

  In step 102, an initial terminal hardware parameter in the secure element is transmitted via a secure channel using the secure element to a server that feeds back identification information based on the terminal hardware parameter.

  The terminal hardware parameter is a hardware parameter of the terminal that identifies the authenticity of the terminal.

  In this embodiment, the terminal hardware parameters are stored in advance in the secure element, and after establishing a secure channel between the secure element and the server, the secure element transmits the terminal hardware parameters to the server via the secure channel. . The terminal hardware parameters acquired by the server are not obtained by detecting the performance of the terminal in real time, but are initially stored in the secure element, so the terminal hardware parameters change as the terminal performance decreases. To ensure the accuracy of the terminal hardware parameters.

  In step 103, a verification result for authenticity of the terminal is determined based on the identification information fed back from the server.

  Since the terminal can directly identify the authenticity of the terminal based on the identification information without scoring the terminal hardware parameters, the operation for identifying the authenticity of the terminal is simplified, thereby verifying the terminal. Efficiency can be increased.

  In summary, the terminal verification method according to the present invention establishes a secure channel with the server by the secure element in the terminal, and uses the secure element to set the initial terminal hardware parameters in the secure element via the secure channel, The identification information is sent back to the server based on the wear parameter, the verification result for the authenticity of the terminal is determined based on the identification information fed back from the server, and the terminal hardware parameter is a parameter that is initially written to the secure element. Therefore, the accuracy of the terminal hardware parameters is guaranteed, and the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance decreases is solved. To achieve the effect of increasing the accuracy to verify the authenticity. In addition, since it is not necessary to calculate the terminal hardware parameter score, and the hardware parameter can be directly read to identify the authenticity of the terminal, the operation for identifying the authenticity of the terminal is simplified, Increase verification efficiency.

  FIG. 2 is a flowchart of a terminal verification method shown in another exemplary embodiment. The terminal verification method is applied to a terminal. As shown in FIG. 2, the terminal verification method includes the following steps.

  In step 201, a secure channel with the server is established by the secure element in the terminal.

  The secure element is an element installed in the terminal. The secure element may be incorporated in the chip of the terminal, or may be incorporated in the accessory and installed in the terminal via the accessory. For example, the secure element may be incorporated into a SIM (Subscriber Identity Module) card, or the secure element may be incorporated into a MicroSD memory card (Micro Secure Digital Memory Card). Of course, the secure element may be incorporated in another accessory, and in the present embodiment, the accessory including the secure element is not limited.

  Since the terminal is not authorized to read data in the secure element, the terminal can establish a secure channel with the secure element by the server, and can acquire data in the secure element by the server. The secure channel is a channel that is established between the secure element and the server and performs data communication between the secure element and the server.

  Establishing a secure channel with the server by a secure element at the terminal includes:

1) A secure element establishes a secure channel establishment request to the server.
2) The secure element receives a selection command transmitted from the server based on the secure channel establishment request and instructing the server to communicate with the secure element, and responds to the selection command.
3) Perform mutual verification with the server using the secure element.
4) After passing each other's verification, establish a secure channel with the secure element.

  If the user needs to verify the authenticity of the terminal, a predetermined application program installed in the terminal can be started, and the terminal transmits a secure channel establishment command to the secure element with the predetermined application program, The secure element triggers a secure channel establishment process under the direction of the secure channel establishment command.

  When establishing a secure channel, the secure element obtains its own secure element indicator and sends the secure element indicator to the server in a secure channel establishment request that directs the secure element request to establish a secure channel. Can do. The server reads the secure element indicator from the received secure channel establishment request, adds the secure element indicator to the selection instruction (SELECT instruction) instructing the server to communicate with the secure element, and transmits the secure element indicator to the secure element. To do. After receiving the selection command, the secure element determines that the server will attempt to communicate with itself and sends a prepared response to the server. After the server receives the response, it triggers each other's verification process with the secure element, and after passing each other's verification, establishes a secure channel between the secure element and the server. Mutual verification ensures the security of the secure element and the server.

  Preferably, the step of mutually verifying with the server by the secure element includes:

1) The first verification information including the initialization update command and the first key value transmitted from the server is received by the secure element.
2) After passing the verification of the first key value by the secure element, the second verification information including the card ciphertext and the second key value generated based on the initialization update command is generated and transmitted to the server To do.
3) The secure element receives the external authentication command transmitted from the server and having the host ciphertext generated and transmitted after passing the verification of the card ciphertext and the second key value by the server.
4) After passing the verification of the host ciphertext by the secure element, it is determined that the mutual verification with the server has been passed.

  In the process of mutual verification, after receiving the response, the server generates a first random number and adds it to the initialization update command, and further, based on the time stamp, the generated second random number, and a fixed character string. A first key value is generated, and an initialization update command and the first key value are added to the first verification information and transmitted to the secure element. The first key value can be a host challenge key.

  After receiving the first verification information, the secure element verifies the first key value, passes the verification for the first key value, and then uses the card ciphertext based on the first random number in the initialization update command. (Card ciphertext) is generated, a second key value is generated based on the time stamp, the generated card random number, and the fixed character string, and the card ciphertext and the second key value are used as the second verification information. Append and send to server. The second key value can be a card challenge key.

  After receiving the second verification information, the server verifies the second key value and the card ciphertext, passes all verifications for the second key value and the card ciphertext, and then sends the host ciphertext (host ciphertext). ), And the host ciphertext is added to the external authentication command and transmitted to the secure element.

  The secure element reads the host ciphertext from the external authentication command, verifies the host ciphertext, passes the verification on the host ciphertext, and then determines that it has passed each other's verification with the server.

  What should be explained is that the secure element needs to verify the first verification information with the secret key, generate the second verification information, and verify the host ciphertext. It is often set before starting the terminal for the first time and cannot be changed, so that the accuracy of mutual verification can be guaranteed.

  In step 202, the secure terminal is used to transmit the initial terminal hardware parameters in the secure element via the secure channel to a server that feeds back identification information based on the terminal hardware parameters.

  The terminal hardware parameter is a hardware parameter of the terminal that identifies the authenticity of the terminal. After the terminal hardware parameters are stored in advance in the secure element and a secure channel is established between the secure element and the server, the secure element transmits the terminal hardware parameters to the server via the secure channel. The terminal hardware parameters acquired by the server are not obtained by detecting the performance of the terminal in real time, but are initially stored in the secure element, so the terminal hardware parameters change as the terminal performance decreases. To ensure the accuracy of the terminal hardware parameters.

  In the present embodiment, the terminal hardware parameters are written to the secure element before starting the terminal for the first time, and the terminal hardware parameters are in an edit prohibited state.

  In actual implementation, the terminal hardware parameters are set by the manufacturer when the terminals are shipped, and the terminal hardware parameters of the terminals in the same batch are the same. Since the terminal hardware parameters in the secure element are written before starting the terminal for the first time and are in an edit prohibited state, the terminal cannot change the terminal hardware parameters in the secure element after the user starts the terminal. However, since the terminal hardware parameter in the secure element is maliciously changed, the problem that the authenticity of the terminal cannot be identified is avoided, and the effect of improving the accuracy of the verification terminal is achieved.

  In step 203, if the identification information is a terminal hardware parameter, the terminal hardware parameter is compared with the reference hardware parameter, and the verification result for the authenticity of the terminal is determined based on the comparison result. If the comparison result is generated after comparing the hardware parameter with the reference hardware parameter, the verification result for the authenticity of the terminal is determined based on the comparison result.

  After the server receives the terminal hardware parameters, the server generates identification information based on the terminal hardware parameters, transmits the identification information to the secure element, and the secure element further verifies the authenticity of the terminal based on the identification information. Can do. In the present embodiment, the step of determining the verification result for the authenticity of the terminal based on the identification information fed back from the server includes the following.

1) If the identification information is a terminal hardware parameter, the terminal hardware parameter is compared with the reference hardware parameter, and the verification result for the authenticity of the terminal is determined based on the comparison result.
2) If the identification information is a comparison result generated after the server compares the terminal hardware parameter with the reference hardware parameter, the verification result for the authenticity of the terminal is determined based on the comparison result.

  When the reference hardware parameter of the regular version terminal is not stored in the server and is stored in the reference hardware parameter in the terminal, the server transmits the received terminal hardware parameter to the terminal as identification information, and the terminal Can compare the terminal hardware parameter with the reference hardware parameter and use the comparison result as the verification result.

  If the standard hardware parameters of the regular version terminal are stored in the server, the server compares the received terminal hardware parameters with the standard hardware parameters and sends the comparison result to the terminal, and the terminal verifies the comparison result as the verification result. It can be. Usually, since the processing capacity of the server is higher than the processing capacity of the terminal, the speed at which the server compares the terminal hardware parameter and the reference hardware parameter is high, and the verification efficiency for the terminal can be increased.

  If the terminal hardware parameters include a model number, serial number, IMEI number, and internal memory, the model number, serial number, IMEI number, and internal memory in the terminal hardware parameter are the model number, serial number, and IMEI number in the reference hardware parameter, respectively. If the model number, serial number, IMEI number, and internal memory in the terminal hardware parameter are the same as the model number, serial number, IMEI number, and internal memory in the reference hardware parameter, the terminal hardware A comparison result indicating that the wear parameter is the same as the reference hardware parameter is acquired, and the terminal is determined to be a regular version terminal based on the comparison result.

  In this embodiment, since the terminal can directly identify the authenticity of the terminal based on the identification information without scoring the terminal hardware parameter, the operation for identifying the authenticity of the terminal is simplified. As a result, the verification efficiency for the terminal can be increased.

  What should be explained is that the secure element is an element installed in the terminal, and the terminal does not need to install a verification application program or further elements, but directly verifies the terminal based on the conventional secure element And verification cost for the terminal can be saved.

  In summary, the terminal verification method according to the present invention establishes a secure channel with the server by the secure element in the terminal, and uses the secure element to set the initial terminal hardware parameters in the secure element via the secure channel, The identification information is sent back to the server based on the wear parameter, the verification result for the authenticity of the terminal is determined based on the identification information fed back from the server, and the terminal hardware parameter is a parameter that is initially written to the secure element. Therefore, the accuracy of the terminal hardware parameters is guaranteed, and the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance decreases is solved. To achieve the effect of increasing the accuracy to verify the authenticity. In addition, since it is not necessary to calculate the terminal hardware parameter score, and the hardware parameter can be directly read to identify the authenticity of the terminal, the operation for identifying the authenticity of the terminal is simplified, Increase verification efficiency.

  In addition, the terminal hardware parameters are written to the secure element before starting the terminal for the first time, and the terminal hardware parameters are in an edit prohibited state. Therefore, after starting the terminal, the terminal hardware parameters in the secure element can be changed. The problem that the terminal hardware parameters stored in the CPU of the terminal are maliciously changed and the verification application program cannot identify the authenticity of the terminal is solved, and the accuracy of verifying the authenticity of the terminal is improved. To achieve.

  FIG. 3 is a block diagram of a terminal verification apparatus shown in one exemplary embodiment, and the terminal verification apparatus is applied to a terminal, and as shown in FIG. A parameter transmission module 320 and a result determination module 330 are included.

  The channel establishment module 310 is configured to establish a secure channel with the server by a secure element at the terminal.

  The parameter transmission module 320 transmits the initial terminal hardware parameters in the secure element via the secure channel established by the channel establishment module 310 using the secure element to a server that feeds back identification information based on the terminal hardware parameters. Configured to do.

  The result determination module 330 is configured to determine a verification result for authenticity of the terminal based on the identification information fed back from the server.

  In summary, the terminal verification apparatus according to the present invention establishes a secure channel with the server by the secure element in the terminal, and uses the secure element to transmit the initial terminal hardware parameters in the secure element via the secure channel to the terminal hardware. The identification information is sent back to the server based on the wear parameter, the verification result for the authenticity of the terminal is determined based on the identification information fed back from the server, and the terminal hardware parameter is a parameter that is initially written to the secure element. Therefore, the accuracy of the terminal hardware parameters is guaranteed, and the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance decreases is solved. To achieve the effect of increasing the accuracy to verify the authenticity. In addition, since it is not necessary to calculate the terminal hardware parameter score, and the hardware parameter can be directly read to identify the authenticity of the terminal, the operation for identifying the authenticity of the terminal is simplified, Increase verification efficiency.

  FIG. 4 is a block diagram of a terminal verification apparatus shown in one exemplary embodiment, and the terminal verification apparatus is applied to a terminal, and as shown in FIG. A parameter transmission module 420 and a result determination module 430 are included.

  The channel establishment module 410 is configured to establish a secure channel with the server by a secure element at the terminal.

  The parameter transmission module 420 transmits the initial terminal hardware parameter in the secure element via the secure channel established by the channel establishment module 410 using the secure element to a server that feeds back identification information based on the terminal hardware parameter. Configured to do.

  The result determination module 430 is configured to determine a verification result for authenticity of the terminal based on the identification information fed back from the server.

  Preferably, the terminal hardware parameter is written to the secure element before starting the terminal for the first time, and the terminal hardware parameter is in an edit prohibited state.

  Preferably, the result determination module 430 includes a first determination submodule 431 or a second determination submodule 432.

  When the identification information is a terminal hardware parameter, the first determination submodule 431 compares the terminal hardware parameter with the reference hardware parameter, and determines the verification result for the authenticity of the terminal based on the comparison result. Configured.

  When the identification information is a comparison result generated after comparing the server terminal hardware parameter with the reference hardware parameter, the second confirmation submodule 432 determines the verification result for the authenticity of the terminal based on the comparison result. Configured as follows.

  Preferably, the channel establishment module 410 includes a request transmission submodule 411, a command response submodule 412, an information verification submodule 413, and a channel establishment submodule 414.

  The request transmission submodule 411 is configured to transmit a secure channel establishment request to the server by a secure element.

  The command response sub-module 412 receives a selection command transmitted by the secure element based on the secure channel establishment request transmitted from the request transmission sub-module 411 and instructing the server to communicate with the secure element. , Configured to respond to the selection instruction.

  The information verification submodule 413 is configured to perform mutual verification with the server using a secure element.

  The channel establishment submodule 414 is configured to establish a secure channel with a secure element after determining that the information verification submodule 413 passed each other's verification.

  Preferably, the information verification submodule 413 includes an information reception submodule 4131, an information transmission submodule 4132, an instruction reception submodule 4133, and a verification confirmation submodule 4134.

  The information reception submodule 4131 is configured to receive first verification information including an initialization update command and a first key value transmitted from the server by a secure element.

  The information transmission submodule 4132 passes the verification of the first key value received by the information reception submodule 4131 by the secure element, and then generates the second key value generated based on the card ciphertext and the initialization update command. Is generated and transmitted to the server.

  The command reception submodule 4133 transmits the host ciphertext generated and transmitted after passing the verification of the card ciphertext and the second key value transmitted from the information transmission submodule 4132 by the server by the secure element. Configured to receive an external authentication command.

  The verification confirmation submodule 4134 is configured to determine that it has passed the mutual verification with the server after passing the verification of the host ciphertext received by the command reception submodule 4133 by the secure element.

  In summary, the terminal verification apparatus according to the present invention establishes a secure channel with the server by the secure element in the terminal, and uses the secure element to transmit the initial terminal hardware parameters in the secure element via the secure channel to the terminal hardware. The identification information is sent back to the server based on the wear parameter, the verification result for the authenticity of the terminal is determined based on the identification information fed back from the server, and the terminal hardware parameter is a parameter that is initially written to the secure element. Therefore, the accuracy of the terminal hardware parameters is guaranteed, and the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance decreases is solved. To achieve the effect of increasing the accuracy to verify the authenticity. In addition, since it is not necessary to calculate the terminal hardware parameter score, and the hardware parameter can be directly read to identify the authenticity of the terminal, the operation for identifying the authenticity of the terminal is simplified, Increase verification efficiency.

  In addition, the terminal hardware parameters are written to the secure element before starting the terminal for the first time, and the terminal hardware parameters are in an edit prohibited state. Therefore, after starting the terminal, the terminal hardware parameters in the secure element can be changed. The problem that the terminal hardware parameters stored in the CPU of the terminal are maliciously changed and the verification application program cannot identify the authenticity of the terminal is solved, and the accuracy of verifying the authenticity of the terminal is improved. To achieve.

  With regard to the apparatus according to the above-described embodiment, the specific manner in which each module performs an operation has been described in detail in the embodiment relating to the method, and thus will not be described in detail here.

  FIG. 5 is a block diagram of a terminal verification apparatus 500 shown in one exemplary embodiment. For example, the device 500 may be a mobile phone, a computer, a digital broadcasting terminal, a message transmission / reception device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, or the like.

  As shown in FIG. 5, apparatus 500 includes process assembly 502, memory 504, power supply assembly 506, multimedia assembly 508, audio assembly 510, input / output (I / O) interface 512, sensor assembly 514, and communication assembly 516. One or more assemblies such as

  The process assembly 502 generally controls the operation of the entire apparatus 500, and controls operations related to, for example, display, telephone call, data communication, camera operation, and recording operation. The process assembly 502 may include one or more processors 518 that execute instructions to implement all or some of the steps of the method. Note that the process assembly 502 may include one or more modules that facilitate interaction between the process assembly 502 and other assemblies. For example, the process assembly 502 may include multimedia modules that facilitate interaction between the multimedia assembly 508 and the process assembly 502.

  The memory 504 is configured to support the operation of the device 500 by storing each type of data. Examples of these data include any application program or method instructions operated on device 500, contact data, phone book data, messages, images, videos, and the like. The memory 504 may be realized by any kind of volatile memory, nonvolatile memory storage device, or a combination thereof, for example, SRAM (Static Random Access Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM. (Erasable Programmable Read Only Memory), PROM (Programmable ROM), ROM (Read Only Member), magnetic memory, flash memory, magnetic disk, or optical disk.

  The power supply assembly 506 provides power to the various assemblies of the device 500. The power supply assembly 506 may include a power management system, one or more power supplies, and other assemblies associated with generating, managing, and allocating power for the device 500.

  The multimedia assembly 508 includes a screen that provides an output interface between the device 500 and the user. In the above embodiment, the screen may include a liquid crystal monitor (LCD) and a touch panel (TP). When the screen includes a touch panel, the screen can be realized as a touch screen and can receive an input signal from a user. The touch panel includes one or more touch sensors, and can detect touches, slides, and gestures on the touch panel. The touch sensor can detect not only the boundary of the touch or slide operation, but also the duration and pressure related to the touch or slide operation. In the above embodiment, the multimedia assembly 508 includes one front camera and / or a rear camera. When the apparatus 500 is in an operation mode such as a shooting mode or a video mode, the front camera and / or the rear camera can receive multimedia data from the outside. Each of the front camera and the rear camera may have one fixed type optical lens system, or one having a variable focal length and an optical zoom function.

  Audio assembly 510 may be configured to input and output audio signals. For example, the audio assembly 510 includes one microphone (MIC), and the device 500 may receive an external audio signal when the device 500 is in an operating mode such as a call mode, a recording mode, and a voice recognition mode. it can. The received audio signal is further stored in the memory 504 or transmitted via the communication assembly 516. In the above embodiment, the audio assembly 510 further includes one speaker for outputting an audio signal.

  The I / O interface 512 provides an interface between the process assembly 502 and the peripheral interface module, and the peripheral interface module may be a keyboard, a click wheel, a button, or the like. These buttons may include, but are not limited to, a home button, volume button, activation button, and locking button.

  The sensor assembly 514 includes one or more sensors for providing the device 500 with an assessment for the condition of each direction. For example, the sensor assembly 514 can detect the relative positioning of an assembly such as the ON / OFF state of the device 500, the display and keypad of the device 500. Also, for example, the sensor assembly 514 may change the position of the device 500 or one assembly of the device 500, whether the user is in contact with the device 500, the orientation of the device 500, or acceleration / deceleration, Can detect changes in temperature. Sensor assembly 514 may include a proximity sensor for detecting the presence of nearby objects in the absence of any physical contact. The sensor assembly 514 may include an optical sensor such as a CMOS or CCD image sensor for application in imaging applications. In the above embodiment, the sensor assembly 514 may further include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, and a temperature sensor.

  The communication assembly 516 provides a wired or wireless form of communication between the device 500 and other equipment. Device 500 may be connected to a wireless network based on a communication standard, such as WiFi, 2G, 3G, or a combination thereof. In one exemplary embodiment, the communication assembly 516 receives a broadcast signal from an external broadcast management system or information related to the broadcast over a broadcast channel. In one exemplary embodiment, the communication assembly 516 further includes a near field communication (NFC) module to facilitate near field communication. For example, the NFC module can be realized based on RFID (Radio Frequency IDentification) technology, IrDA (Infrared Data Association) technology, UWB (Ultra Wide Band) technology, BT (Bluetooth) technology, and other technologies.

  In an exemplary embodiment, the apparatus 500 includes one or more ASICs (Application Specific Integrated Circuits), DSPs (Digital Signal Processors), DSPDs (Digital Signal Processing Devices), PLDs (Progressive Integral Circuits). Gate Array), controller, microcontroller, microprocessor, or other electronic component that performs the above method.

  The exemplary embodiment further provides a computer-readable non-transitory storage medium containing instructions, eg, a memory 504 containing instructions, wherein the instructions are executed by the processor 518 of the apparatus 500 to execute the method. To realize. For example, the computer-readable non-transitory storage medium may be ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like.

  For those skilled in the art, other embodiments of the present invention can be easily conceived after implementing the present invention in consideration of the specification. This application is intended to cover any variations, uses, or adaptive changes of the present invention which, in accordance with the general principles of the present invention, are not disclosed herein. It includes well-known common sense or conventional technical means in the field. The specification and examples are illustrative only, and the true scope and spirit of the invention is within the scope of the claims.

  It should be understood that the present invention is not limited to the exact structure described above and shown in the drawings, and various corrections and changes can be made without departing from the scope of the invention. The scope of the invention is limited only by the claims.

  This application claims priority based on a Chinese patent application with an application number of CN20141602394.8 and an application date of October 31, 2014, the entire contents of which are incorporated herein by reference.

The present invention relates to the technical field of computers, and more particularly to a terminal verification method , apparatus , program, and recording medium .

  As the speed at which a user replaces a terminal increases, some manufacturers may remove parts from the terminals discarded by the user and assemble the removed parts into one terminal for sale. Since the performance of the terminal obtained by assembling is not stable, the user needs to verify the purchased terminal and identify the authenticity of the terminal.

  If the verification application program is installed in the terminal, the terminal executes the verification application program and uses the verification application program from the CPU (Central Processing Unit) of the terminal to enter the model number, serial number, and IMEI (International Mobile). Terminal hardware parameters, including equipment identity, international mobile device identification number), internal memory, CPU parameters, camera parameters, etc., and compare terminal hardware parameters with the standard hardware parameters of the official version terminal. The score of the wear parameter can be calculated, and the authenticity of the terminal can be determined based on the score.

  In the process of realizing the present invention, the inventor, in the related art, at least when the terminal is used for a long time and the performance deteriorates, the rating of the terminal hardware parameter decreases, and the verification application program executes the authenticity of the terminal. It was discovered that there was a flaw that could not be identified.

The present invention provides a terminal verification method , apparatus , program, and recording medium in order to solve the problem that the authenticity of the verification application program terminal cannot be identified because the terminal performance deteriorates.

According to a first form of embodiment of the invention,
Establishing a secure channel with the server by a secure element at the terminal;
Transmitting an initial terminal hardware parameter in the secure element via the secure channel using the secure element to the server that feeds back identification information based on the terminal hardware parameter;
Confirming a verification result for authenticity of the terminal based on the identification information fed back from the server;
A terminal verification method is provided.

  Preferably, the terminal hardware parameter is written to the secure element before starting the terminal for the first time, and the terminal hardware parameter is in an edit prohibited state.

Preferably, the step of determining a verification result for authenticity of the terminal based on the identification information fed back from the server includes:
If the identification information is the terminal hardware parameter, comparing the terminal hardware parameter with a reference hardware parameter, and determining a verification result for the authenticity of the terminal based on the comparison result;
If the identification information is a comparison result generated after the server compares the terminal hardware parameter with a reference hardware parameter, the verification result for the authenticity of the terminal is determined based on the comparison result; Including.

Preferably, establishing a secure channel with a server by a secure element in the terminal comprises:
Sending a secure channel establishment request to the server by the secure element;
Receiving a selection command sent by the secure element based on the secure channel establishment request instructing the server to communicate with the secure element, and responding to the selection command;
Performing mutual verification with the server by the secure element;
Establishing the secure channel with the secure element after passing each other's verification.

Preferably, performing the mutual verification with the server by the secure element comprises:
Receiving, by the secure element, first verification information including an initialization update command and a first key value transmitted from the server;
After passing the verification of the first key value by the secure element, the server generates a second verification information including a card ciphertext and a second key value generated based on the initialization update command, and Sending to
Receiving an external authentication command having a host ciphertext generated and transmitted after passing through verification of the card ciphertext and the second key value by the server, transmitted from the server by the secure element;
After passing the verification of the host ciphertext by the secure element, and confirming that the verification with the server has passed each other.

According to the second aspect of the embodiment of the present invention,
A channel establishment module configured to establish a secure channel with the server by a secure element at the terminal;
The secure element is configured to transmit an initial terminal hardware parameter in the secure element to the server that feeds back identification information based on the terminal hardware parameter, using the secure channel established by the channel establishment module. A parameter transmission module
A result determination module configured to determine a verification result for authenticity of the terminal based on the identification information fed back from the server;
A terminal verification apparatus including

  Preferably, the terminal hardware parameter is written to the secure element before starting the terminal for the first time, and the terminal hardware parameter is in an edit prohibited state.

Preferably, the result determination module is
When the identification information is the terminal hardware parameter, the terminal hardware parameter is compared with a reference hardware parameter, and a verification result for the authenticity of the terminal is determined based on the comparison result. A confirmation submodule of
When the identification information is a comparison result generated after the server compares the terminal hardware parameter with a reference hardware parameter, the identification information is configured to determine a verification result for the authenticity of the terminal based on the comparison result. A second deterministic submodule.

Preferably, the channel establishment module is
A request sending sub-module configured to send a secure channel establishment request to the server by the secure element;
The selection is received by the secure element based on the secure channel establishment request transmitted from the request transmission submodule by the server and instructing the server to communicate with the secure element. A command response sub-module configured to respond to the command;
An information verification sub-module configured to perform mutual verification with the server by the secure element;
A channel establishment sub-module configured to establish the secure channel by the secure element after the information verification sub-module has determined that it has passed each other's verification.

Preferably, the information verification submodule includes:
An information receiving submodule configured to receive first verification information including an initialization update command and a first key value transmitted from the server by the secure element;
A second key value including a card ciphertext and a second key value generated based on the initialization update command after passing through the verification of the first key value received by the information receiving submodule by the secure element; An information transmission sub-module configured to generate and send verification information to the server;
External authentication having the host ciphertext generated and transmitted after passing the verification of the second key value and the card ciphertext transmitted from the information transmission submodule by the server, transmitted from the server by the secure element An instruction receiving submodule configured to receive instructions;
A verification confirmation submodule configured to determine that it has passed verification of each other with the server after passing verification of the host ciphertext received in the command reception submodule by the secure element; including.

According to the third aspect of the embodiment of the present invention,
A processor;
A memory for storing instructions executable by the processor,
The processor is
Establish a secure channel with the server using the secure element at the terminal,
Transmitting the initial terminal hardware parameters in the secure element via the secure channel using the secure element to the server that feeds back identification information based on the terminal hardware parameters;
Provided is a terminal verification device configured to determine a verification result for authenticity of the terminal based on the identification information fed back from the server.

According to the fourth aspect of the embodiment of the present invention,
  By being executed by a processor, a program characterized by realizing the terminal verification method is provided.

According to the fifth aspect of the embodiment of the present invention,
  A recording medium on which the program is recorded is provided.

  The technical means provided by the embodiments of the present invention can include the following beneficial effects.

  A secure channel with the server is established by the secure element at the terminal, and the initial terminal hardware parameter in the secure element is transmitted to the server that feeds back identification information based on the terminal hardware parameter via the secure channel using the secure element. The verification result for the authenticity of the terminal is determined based on the identification information fed back from the server, and the terminal hardware parameters are parameters that are initially written in the secure element and do not change as the terminal performance decreases. This guarantees the accuracy of the terminal hardware parameters, solves the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance deteriorates, and improves the accuracy of verifying the authenticity of the terminal To. In addition, since it is not necessary to calculate the terminal hardware parameter score, and the hardware parameter can be directly read to identify the authenticity of the terminal, the operation for identifying the authenticity of the terminal is simplified, Increase verification efficiency.

  It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the invention.

The drawings are hereby incorporated into the specification and are a part of the specification, illustrating examples consistent with the present invention and illustrating the principles of the invention together with the specification.
3 is a flowchart of a terminal verification method shown in an exemplary embodiment. 6 is a flowchart of a terminal verification method shown in another exemplary embodiment. FIG. 2 is a block diagram of a terminal verification apparatus shown in one exemplary embodiment. FIG. 2 is a block diagram of a terminal verification apparatus shown in one exemplary embodiment. FIG. 2 is a block diagram of a terminal verification apparatus shown in one exemplary embodiment.

  Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the drawings. When the following description relates to the drawings, the same reference numerals in different drawings denote the same or common elements unless otherwise indicated. All embodiments consistent with the present invention are not limited to the embodiments described in the following illustrative examples. Conversely, the embodiments described in the following illustrative examples are merely illustrative of apparatus and methods consistent with certain aspects of the present invention that are described in detail in the claims.

  FIG. 1 is a flowchart of a terminal verification method shown in one exemplary embodiment. The terminal verification method is applied to a terminal. As shown in FIG. 1, the terminal verification method includes the following steps.

  In step 101, a secure channel with the server is established by a secure element in the terminal.

  The secure element (Secure Element) is an element installed in the terminal. Since the terminal is not authorized to read data in the secure element, the terminal can establish a secure channel with the secure element by the server, and can acquire data in the secure element by the server. The secure channel is a channel that is established between the secure element and the server and performs data communication between the secure element and the server.

  In step 102, an initial terminal hardware parameter in the secure element is transmitted via a secure channel using the secure element to a server that feeds back identification information based on the terminal hardware parameter.

  The terminal hardware parameter is a hardware parameter of the terminal that identifies the authenticity of the terminal.

  In this embodiment, the terminal hardware parameters are stored in advance in the secure element, and after establishing a secure channel between the secure element and the server, the secure element transmits the terminal hardware parameters to the server via the secure channel. . The terminal hardware parameters acquired by the server are not obtained by detecting the performance of the terminal in real time, but are initially stored in the secure element, so the terminal hardware parameters change as the terminal performance decreases. To ensure the accuracy of the terminal hardware parameters.

  In step 103, a verification result for authenticity of the terminal is determined based on the identification information fed back from the server.

  Since the terminal can directly identify the authenticity of the terminal based on the identification information without scoring the terminal hardware parameters, the operation for identifying the authenticity of the terminal is simplified, thereby verifying the terminal. Efficiency can be increased.

  In summary, the terminal verification method according to the present invention establishes a secure channel with the server by the secure element in the terminal, and uses the secure element to set the initial terminal hardware parameters in the secure element via the secure channel, The identification information is sent back to the server based on the wear parameter, the verification result for the authenticity of the terminal is determined based on the identification information fed back from the server, and the terminal hardware parameter is a parameter that is initially written to the secure element. Therefore, the accuracy of the terminal hardware parameters is guaranteed, and the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance decreases is solved. To achieve the effect of increasing the accuracy to verify the authenticity. In addition, since it is not necessary to calculate the terminal hardware parameter score, and the hardware parameter can be directly read to identify the authenticity of the terminal, the operation for identifying the authenticity of the terminal is simplified, Increase verification efficiency.

  FIG. 2 is a flowchart of a terminal verification method shown in another exemplary embodiment. The terminal verification method is applied to a terminal. As shown in FIG. 2, the terminal verification method includes the following steps.

  In step 201, a secure channel with the server is established by the secure element in the terminal.

  The secure element is an element installed in the terminal. The secure element may be incorporated in the chip of the terminal, or may be incorporated in the accessory and installed in the terminal via the accessory. For example, the secure element may be incorporated into a SIM (Subscriber Identity Module) card, or the secure element may be incorporated into a MicroSD memory card (Micro Secure Digital Memory Card). Of course, the secure element may be incorporated in another accessory, and in the present embodiment, the accessory including the secure element is not limited.

  Since the terminal is not authorized to read data in the secure element, the terminal can establish a secure channel with the secure element by the server, and can acquire data in the secure element by the server. The secure channel is a channel that is established between the secure element and the server and performs data communication between the secure element and the server.

  Establishing a secure channel with the server by a secure element at the terminal includes:

1) A secure element establishes a secure channel establishment request to the server.
2) The secure element receives a selection command transmitted from the server based on the secure channel establishment request and instructing the server to communicate with the secure element, and responds to the selection command.
3) Perform mutual verification with the server using the secure element.
4) After passing each other's verification, establish a secure channel with the secure element.

  If the user needs to verify the authenticity of the terminal, a predetermined application program installed in the terminal can be started, and the terminal transmits a secure channel establishment command to the secure element with the predetermined application program, The secure element triggers a secure channel establishment process under the direction of the secure channel establishment command.

  When establishing a secure channel, the secure element obtains its own secure element indicator and sends the secure element indicator to the server in a secure channel establishment request that directs the secure element request to establish a secure channel. Can do. The server reads the secure element indicator from the received secure channel establishment request, adds the secure element indicator to the selection instruction (SELECT instruction) instructing the server to communicate with the secure element, and transmits the secure element indicator to the secure element. To do. After receiving the selection command, the secure element determines that the server will attempt to communicate with itself and sends a prepared response to the server. After the server receives the response, it triggers each other's verification process with the secure element, and after passing each other's verification, establishes a secure channel between the secure element and the server. Mutual verification ensures the security of the secure element and the server.

  Preferably, the step of mutually verifying with the server by the secure element includes:

1) The first verification information including the initialization update command and the first key value transmitted from the server is received by the secure element.
2) After passing the verification of the first key value by the secure element, the second verification information including the card ciphertext and the second key value generated based on the initialization update command is generated and transmitted to the server To do.
3) The secure element receives the external authentication command transmitted from the server and having the host ciphertext generated and transmitted after passing the verification of the card ciphertext and the second key value by the server.
4) After passing the verification of the host ciphertext by the secure element, it is determined that the mutual verification with the server has been passed.

  In the process of mutual verification, after receiving the response, the server generates a first random number and adds it to the initialization update command, and further, based on the time stamp, the generated second random number, and a fixed character string. A first key value is generated, and an initialization update command and the first key value are added to the first verification information and transmitted to the secure element. The first key value can be a host challenge key.

  After receiving the first verification information, the secure element verifies the first key value, passes the verification for the first key value, and then uses the card ciphertext based on the first random number in the initialization update command. (Card ciphertext) is generated, a second key value is generated based on the time stamp, the generated card random number, and the fixed character string, and the card ciphertext and the second key value are used as the second verification information. Append and send to server. The second key value can be a card challenge key.

  After receiving the second verification information, the server verifies the second key value and the card ciphertext, passes all verifications for the second key value and the card ciphertext, and then sends the host ciphertext (host ciphertext). ), And the host ciphertext is added to the external authentication command and transmitted to the secure element.

  The secure element reads the host ciphertext from the external authentication command, verifies the host ciphertext, passes the verification on the host ciphertext, and then determines that it has passed each other's verification with the server.

  What should be explained is that the secure element needs to verify the first verification information with the secret key, generate the second verification information, and verify the host ciphertext. It is often set before starting the terminal for the first time and cannot be changed, so that the accuracy of mutual verification can be guaranteed.

  In step 202, the secure terminal is used to transmit the initial terminal hardware parameters in the secure element via the secure channel to a server that feeds back identification information based on the terminal hardware parameters.

  The terminal hardware parameter is a hardware parameter of the terminal that identifies the authenticity of the terminal. After the terminal hardware parameters are stored in advance in the secure element and a secure channel is established between the secure element and the server, the secure element transmits the terminal hardware parameters to the server via the secure channel. The terminal hardware parameters acquired by the server are not obtained by detecting the performance of the terminal in real time, but are initially stored in the secure element, so the terminal hardware parameters change as the terminal performance decreases. To ensure the accuracy of the terminal hardware parameters.

  In the present embodiment, the terminal hardware parameters are written to the secure element before starting the terminal for the first time, and the terminal hardware parameters are in an edit prohibited state.

  In actual implementation, the terminal hardware parameters are set by the manufacturer when the terminals are shipped, and the terminal hardware parameters of the terminals in the same batch are the same. Since the terminal hardware parameters in the secure element are written before starting the terminal for the first time and are in an edit prohibited state, the terminal cannot change the terminal hardware parameters in the secure element after the user starts the terminal. However, since the terminal hardware parameter in the secure element is maliciously changed, the problem that the authenticity of the terminal cannot be identified is avoided, and the effect of improving the accuracy of the verification terminal is achieved.

  In step 203, if the identification information is a terminal hardware parameter, the terminal hardware parameter is compared with the reference hardware parameter, and the verification result for the authenticity of the terminal is determined based on the comparison result. If the comparison result is generated after comparing the hardware parameter with the reference hardware parameter, the verification result for the authenticity of the terminal is determined based on the comparison result.

  After the server receives the terminal hardware parameters, the server generates identification information based on the terminal hardware parameters, transmits the identification information to the secure element, and the secure element further verifies the authenticity of the terminal based on the identification information. Can do. In the present embodiment, the step of determining the verification result for the authenticity of the terminal based on the identification information fed back from the server includes the following.

1) If the identification information is a terminal hardware parameter, the terminal hardware parameter is compared with the reference hardware parameter, and the verification result for the authenticity of the terminal is determined based on the comparison result.
2) If the identification information is a comparison result generated after the server compares the terminal hardware parameter with the reference hardware parameter, the verification result for the authenticity of the terminal is determined based on the comparison result.

  When the reference hardware parameter of the regular version terminal is not stored in the server and is stored in the reference hardware parameter in the terminal, the server transmits the received terminal hardware parameter to the terminal as identification information, and the terminal Can compare the terminal hardware parameter with the reference hardware parameter and use the comparison result as the verification result.

  If the standard hardware parameters of the regular version terminal are stored in the server, the server compares the received terminal hardware parameters with the standard hardware parameters and sends the comparison result to the terminal, and the terminal verifies the comparison result as the verification result. It can be. Usually, since the processing capacity of the server is higher than the processing capacity of the terminal, the speed at which the server compares the terminal hardware parameter and the reference hardware parameter is high, and the verification efficiency for the terminal can be increased.

  If the terminal hardware parameters include a model number, serial number, IMEI number, and internal memory, the model number, serial number, IMEI number, and internal memory in the terminal hardware parameter are the model number, serial number, and IMEI number in the reference hardware parameter, respectively. If the model number, serial number, IMEI number, and internal memory in the terminal hardware parameter are the same as the model number, serial number, IMEI number, and internal memory in the reference hardware parameter, the terminal hardware A comparison result indicating that the wear parameter is the same as the reference hardware parameter is acquired, and the terminal is determined to be a regular version terminal based on the comparison result.

  In this embodiment, since the terminal can directly identify the authenticity of the terminal based on the identification information without scoring the terminal hardware parameter, the operation for identifying the authenticity of the terminal is simplified. As a result, the verification efficiency for the terminal can be increased.

  What should be explained is that the secure element is an element installed in the terminal, and the terminal does not need to install a verification application program or further elements, but directly verifies the terminal based on the conventional secure element And verification cost for the terminal can be saved.

  In summary, the terminal verification method according to the present invention establishes a secure channel with the server by the secure element in the terminal, and uses the secure element to set the initial terminal hardware parameters in the secure element via the secure channel, The identification information is sent back to the server based on the wear parameter, the verification result for the authenticity of the terminal is determined based on the identification information fed back from the server, and the terminal hardware parameter is a parameter that is initially written to the secure element. Therefore, the accuracy of the terminal hardware parameters is guaranteed, and the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance decreases is solved. To achieve the effect of increasing the accuracy to verify the authenticity. In addition, since it is not necessary to calculate the terminal hardware parameter score, and the hardware parameter can be directly read to identify the authenticity of the terminal, the operation for identifying the authenticity of the terminal is simplified, Increase verification efficiency.

  In addition, the terminal hardware parameters are written to the secure element before starting the terminal for the first time, and the terminal hardware parameters are in an edit prohibited state. Therefore, after starting the terminal, the terminal hardware parameters in the secure element can be changed. The problem that the terminal hardware parameters stored in the CPU of the terminal are maliciously changed and the verification application program cannot identify the authenticity of the terminal is solved, and the accuracy of verifying the authenticity of the terminal is improved. To achieve.

  FIG. 3 is a block diagram of a terminal verification apparatus shown in one exemplary embodiment, and the terminal verification apparatus is applied to a terminal, and as shown in FIG. A parameter transmission module 320 and a result determination module 330 are included.

  The channel establishment module 310 is configured to establish a secure channel with the server by a secure element at the terminal.

  The parameter transmission module 320 transmits the initial terminal hardware parameters in the secure element via the secure channel established by the channel establishment module 310 using the secure element to a server that feeds back identification information based on the terminal hardware parameters. Configured to do.

  The result determination module 330 is configured to determine a verification result for authenticity of the terminal based on the identification information fed back from the server.

  In summary, the terminal verification apparatus according to the present invention establishes a secure channel with the server by the secure element in the terminal, and uses the secure element to transmit the initial terminal hardware parameters in the secure element via the secure channel to the terminal hardware. The identification information is sent back to the server based on the wear parameter, the verification result for the authenticity of the terminal is determined based on the identification information fed back from the server, and the terminal hardware parameter is a parameter that is initially written to the secure element. Therefore, the accuracy of the terminal hardware parameters is guaranteed, and the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance decreases is solved. To achieve the effect of increasing the accuracy to verify the authenticity. In addition, since it is not necessary to calculate the terminal hardware parameter score, and the hardware parameter can be directly read to identify the authenticity of the terminal, the operation for identifying the authenticity of the terminal is simplified, Increase verification efficiency.

  FIG. 4 is a block diagram of a terminal verification apparatus shown in one exemplary embodiment, and the terminal verification apparatus is applied to a terminal, and as shown in FIG. A parameter transmission module 420 and a result determination module 430 are included.

  The channel establishment module 410 is configured to establish a secure channel with the server by a secure element at the terminal.

  The parameter transmission module 420 transmits the initial terminal hardware parameter in the secure element via the secure channel established by the channel establishment module 410 using the secure element to a server that feeds back identification information based on the terminal hardware parameter. Configured to do.

  The result determination module 430 is configured to determine a verification result for authenticity of the terminal based on the identification information fed back from the server.

  Preferably, the terminal hardware parameter is written to the secure element before starting the terminal for the first time, and the terminal hardware parameter is in an edit prohibited state.

  Preferably, the result determination module 430 includes a first determination submodule 431 or a second determination submodule 432.

  When the identification information is a terminal hardware parameter, the first determination submodule 431 compares the terminal hardware parameter with the reference hardware parameter, and determines the verification result for the authenticity of the terminal based on the comparison result. Configured.

  When the identification information is a comparison result generated after comparing the server terminal hardware parameter with the reference hardware parameter, the second confirmation submodule 432 determines the verification result for the authenticity of the terminal based on the comparison result. Configured as follows.

  Preferably, the channel establishment module 410 includes a request transmission submodule 411, a command response submodule 412, an information verification submodule 413, and a channel establishment submodule 414.

  The request transmission submodule 411 is configured to transmit a secure channel establishment request to the server by a secure element.

  The command response sub-module 412 receives a selection command transmitted by the secure element based on the secure channel establishment request transmitted from the request transmission sub-module 411 and instructing the server to communicate with the secure element. , Configured to respond to the selection instruction.

  The information verification submodule 413 is configured to perform mutual verification with the server using a secure element.

  The channel establishment submodule 414 is configured to establish a secure channel with a secure element after determining that the information verification submodule 413 passed each other's verification.

  Preferably, the information verification submodule 413 includes an information reception submodule 4131, an information transmission submodule 4132, an instruction reception submodule 4133, and a verification confirmation submodule 4134.

  The information reception submodule 4131 is configured to receive first verification information including an initialization update command and a first key value transmitted from the server by a secure element.

  The information transmission submodule 4132 passes the verification of the first key value received by the information reception submodule 4131 by the secure element, and then generates the second key value generated based on the card ciphertext and the initialization update command. Is generated and transmitted to the server.

  The command reception submodule 4133 transmits the host ciphertext generated and transmitted after passing the verification of the card ciphertext and the second key value transmitted from the information transmission submodule 4132 by the server by the secure element. Configured to receive an external authentication command.

  The verification confirmation submodule 4134 is configured to determine that it has passed the mutual verification with the server after passing the verification of the host ciphertext received by the command reception submodule 4133 by the secure element.

  In summary, the terminal verification apparatus according to the present invention establishes a secure channel with the server by the secure element in the terminal, and uses the secure element to transmit the initial terminal hardware parameters in the secure element via the secure channel to the terminal hardware. The identification information is sent back to the server based on the wear parameter, the verification result for the authenticity of the terminal is determined based on the identification information fed back from the server, and the terminal hardware parameter is a parameter that is initially written to the secure element. Therefore, the accuracy of the terminal hardware parameters is guaranteed, and the problem that the verification application program cannot identify the authenticity of the terminal because the terminal performance decreases is solved. To achieve the effect of increasing the accuracy to verify the authenticity. In addition, since it is not necessary to calculate the terminal hardware parameter score, and the hardware parameter can be directly read to identify the authenticity of the terminal, the operation for identifying the authenticity of the terminal is simplified, Increase verification efficiency.

  In addition, the terminal hardware parameters are written to the secure element before starting the terminal for the first time, and the terminal hardware parameters are in an edit prohibited state. Therefore, after starting the terminal, the terminal hardware parameters in the secure element can be changed. The problem that the terminal hardware parameters stored in the CPU of the terminal are maliciously changed and the verification application program cannot identify the authenticity of the terminal is solved, and the accuracy of verifying the authenticity of the terminal is improved. To achieve.

  With regard to the apparatus according to the above-described embodiment, the specific manner in which each module performs an operation has been described in detail in the embodiment relating to the method, and thus will not be described in detail here.

  FIG. 5 is a block diagram of a terminal verification apparatus 500 shown in one exemplary embodiment. For example, the device 500 may be a mobile phone, a computer, a digital broadcasting terminal, a message transmission / reception device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, or the like.

  As shown in FIG. 5, apparatus 500 includes process assembly 502, memory 504, power supply assembly 506, multimedia assembly 508, audio assembly 510, input / output (I / O) interface 512, sensor assembly 514, and communication assembly 516. One or more assemblies such as

  The process assembly 502 generally controls the operation of the entire apparatus 500, and controls operations related to, for example, display, telephone call, data communication, camera operation, and recording operation. The process assembly 502 may include one or more processors 518 that execute instructions to implement all or some of the steps of the method. Note that the process assembly 502 may include one or more modules that facilitate interaction between the process assembly 502 and other assemblies. For example, the process assembly 502 may include multimedia modules that facilitate interaction between the multimedia assembly 508 and the process assembly 502.

  The memory 504 is configured to support the operation of the device 500 by storing each type of data. Examples of these data include any application program or method instructions operated on device 500, contact data, phone book data, messages, images, videos, and the like. The memory 504 may be realized by any kind of volatile memory, nonvolatile memory storage device, or a combination thereof, for example, SRAM (Static Random Access Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM. (Erasable Programmable Read Only Memory), PROM (Programmable ROM), ROM (Read Only Member), magnetic memory, flash memory, magnetic disk, or optical disk.

  The power supply assembly 506 provides power to the various assemblies of the device 500. The power supply assembly 506 may include a power management system, one or more power supplies, and other assemblies associated with generating, managing, and allocating power for the device 500.

  The multimedia assembly 508 includes a screen that provides an output interface between the device 500 and the user. In the above embodiment, the screen may include a liquid crystal monitor (LCD) and a touch panel (TP). When the screen includes a touch panel, the screen can be realized as a touch screen and can receive an input signal from a user. The touch panel includes one or more touch sensors, and can detect touches, slides, and gestures on the touch panel. The touch sensor can detect not only the boundary of the touch or slide operation, but also the duration and pressure related to the touch or slide operation. In the above embodiment, the multimedia assembly 508 includes one front camera and / or a rear camera. When the apparatus 500 is in an operation mode such as a shooting mode or a video mode, the front camera and / or the rear camera can receive multimedia data from the outside. Each of the front camera and the rear camera may have one fixed type optical lens system, or one having a variable focal length and an optical zoom function.

  Audio assembly 510 may be configured to input and output audio signals. For example, the audio assembly 510 includes one microphone (MIC), and the device 500 may receive an external audio signal when the device 500 is in an operating mode such as a call mode, a recording mode, and a voice recognition mode. it can. The received audio signal is further stored in the memory 504 or transmitted via the communication assembly 516. In the above embodiment, the audio assembly 510 further includes one speaker for outputting an audio signal.

  The I / O interface 512 provides an interface between the process assembly 502 and the peripheral interface module, and the peripheral interface module may be a keyboard, a click wheel, a button, or the like. These buttons may include, but are not limited to, a home button, volume button, activation button, and locking button.

  The sensor assembly 514 includes one or more sensors for providing the device 500 with an assessment for the condition of each direction. For example, the sensor assembly 514 can detect the relative positioning of an assembly such as the ON / OFF state of the device 500, the display and keypad of the device 500. Also, for example, the sensor assembly 514 may change the position of the device 500 or one assembly of the device 500, whether the user is in contact with the device 500, the orientation of the device 500, or acceleration / deceleration, Can detect changes in temperature. Sensor assembly 514 may include a proximity sensor for detecting the presence of nearby objects in the absence of any physical contact. The sensor assembly 514 may include an optical sensor such as a CMOS or CCD image sensor for application in imaging applications. In the above embodiment, the sensor assembly 514 may further include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, and a temperature sensor.

  The communication assembly 516 provides a wired or wireless form of communication between the device 500 and other equipment. Device 500 may be connected to a wireless network based on a communication standard, such as WiFi, 2G, 3G, or a combination thereof. In one exemplary embodiment, the communication assembly 516 receives a broadcast signal from an external broadcast management system or information related to the broadcast over a broadcast channel. In one exemplary embodiment, the communication assembly 516 further includes a near field communication (NFC) module to facilitate near field communication. For example, the NFC module can be realized based on RFID (Radio Frequency IDentification) technology, IrDA (Infrared Data Association) technology, UWB (Ultra Wide Band) technology, BT (Bluetooth) technology, and other technologies.

  In an exemplary embodiment, the apparatus 500 includes one or more ASICs (Application Specific Integrated Circuits), DSPs (Digital Signal Processors), DSPDs (Digital Signal Processing Devices), PLDs (Progressive Integral Circuits). Gate Array), controller, microcontroller, microprocessor, or other electronic component that performs the above method.

  The exemplary embodiment further provides a computer-readable non-transitory storage medium containing instructions, eg, a memory 504 containing instructions, wherein the instructions are executed by the processor 518 of the apparatus 500 to execute the method. To realize. For example, the computer-readable non-transitory storage medium may be ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like.

  For those skilled in the art, other embodiments of the present invention can be easily conceived after implementing the present invention in consideration of the specification. This application is intended to cover any variations, uses, or adaptive changes of the present invention which, in accordance with the general principles of the present invention, are not disclosed herein. It includes well-known common sense or conventional technical means in the field. The specification and examples are illustrative only, and the true scope and spirit of the invention is within the scope of the claims.

  It should be understood that the present invention is not limited to the exact structure described above and shown in the drawings, and various corrections and changes can be made without departing from the scope of the invention. The scope of the invention is limited only by the claims.

Claims (11)

Establishing a secure channel with the server by a secure element at the terminal;
Transmitting an initial terminal hardware parameter in the secure element via the secure channel using the secure element to the server that feeds back identification information based on the terminal hardware parameter;
Confirming a verification result for authenticity of the terminal based on the identification information fed back from the server;
The terminal verification method characterized by including.   The method according to claim 1, wherein the terminal hardware parameter is written to the secure element before starting the terminal for the first time, and the terminal hardware parameter is in an edit prohibited state. The step of determining the verification result for the authenticity of the terminal based on the identification information fed back from the server,
If the identification information is the terminal hardware parameter, comparing the terminal hardware parameter with a reference hardware parameter, and determining a verification result for the authenticity of the terminal based on the comparison result;
If the identification information is a comparison result generated after the server compares the terminal hardware parameter with a reference hardware parameter, the verification result for the authenticity of the terminal based on the comparison result,
The method of claim 1, comprising: Establishing a secure channel with a server by a secure element in the terminal,
Sending a secure channel establishment request to the server by the secure element;
Receiving a selection command sent by the secure element based on the secure channel establishment request instructing the server to communicate with the secure element, and responding to the selection command;
Performing mutual verification with the server by the secure element;
Establishing the secure channel with the secure element after passing each other's verification;
The method according to claim 1, comprising: The step of performing mutual verification with the server by the secure element includes:
Receiving, by the secure element, first verification information including an initialization update command and a first key value transmitted from the server;
After passing the verification of the first key value by the secure element, the server generates a second verification information including a card ciphertext and a second key value generated based on the initialization update command, and Sending to
Receiving an external authentication command having a host ciphertext generated and transmitted after passing through verification of the card ciphertext and the second key value by the server, transmitted from the server by the secure element;
After passing the verification of the host ciphertext by the secure element, and confirming that the mutual verification with the server has passed;
5. The method of claim 4, comprising: A channel establishment module configured to establish a secure channel with the server by a secure element at the terminal;
The secure element is configured to transmit an initial terminal hardware parameter in the secure element to the server that feeds back identification information based on the terminal hardware parameter, using the secure channel established by the channel establishment module. A parameter transmission module
A result determination module configured to determine a verification result for authenticity of the terminal based on the identification information fed back from the server;
A terminal verification apparatus comprising: The terminal hardware parameter is written to the secure element before starting the terminal for the first time, and the terminal hardware parameter is in an edit prohibited state.
The apparatus according to claim 6. The result determination module includes:
When the identification information is the terminal hardware parameter, the terminal hardware parameter is compared with a reference hardware parameter, and a verification result for the authenticity of the terminal is determined based on the comparison result. A confirmation submodule of
When the identification information is a comparison result generated after the server compares the terminal hardware parameter with a reference hardware parameter, the identification information is configured to determine a verification result for the authenticity of the terminal based on the comparison result. A second deterministic submodule,
7. The apparatus of claim 6 comprising: The channel establishment module
A request sending sub-module configured to send a secure channel establishment request to the server by the secure element;
The selection is received by the secure element based on the secure channel establishment request transmitted from the request transmission submodule by the server and instructing the server to communicate with the secure element. A command response sub-module configured to respond to the command;
An information verification sub-module configured to perform mutual verification with the server by the secure element;
A channel establishment submodule configured to establish the secure channel by the secure element after determining that the information validation submodules have passed each other's validation;
The device according to any one of claims 6 to 8, characterized by comprising: The information verification submodule includes:
An information receiving submodule configured to receive first verification information including an initialization update command and a first key value transmitted from the server by the secure element;
A second key value including a card ciphertext and a second key value generated based on the initialization update command after passing through the verification of the first key value received by the information receiving submodule by the secure element; An information transmission sub-module configured to generate and send verification information to the server;
External authentication having the host ciphertext generated and transmitted after passing the verification of the second key value and the card ciphertext transmitted from the information transmission submodule by the server, transmitted from the server by the secure element An instruction receiving submodule configured to receive instructions;
A verification confirmation submodule configured to determine that it has passed verification of each other with the server after passing verification of the host ciphertext received in the command reception submodule by the secure element;
10. The device of claim 9, comprising: A processor;
A memory for storing instructions executable by the processor,
The processor is
Establish a secure channel with the server using the secure element at the terminal,
Transmitting the initial terminal hardware parameters in the secure element via the secure channel using the secure element to the server that feeds back identification information based on the terminal hardware parameters;
Confirming the verification result for the authenticity of the terminal based on the identification information fed back from the server;
A terminal verification apparatus configured as described above.

Images